/opt/chainguard/in-toto/bin/in-toto-record

usage: in-toto-record [-h] [--version] {start,stop} ...

in-toto-record creates a signed link metadata file in two steps, in order to
provide evidence for supply chain steps that cannot be carried out by a single
command (for which 'in-toto-run' should be used). It returns a non-zero value
on failure and zero otherwise.

Positional Arguments:
  {start,stop}
    start       creates a preliminary link file recording the paths and hashes of the passed
                materials and signs it with the passed functionary's key. The resulting link file
                is stored as '.<name>.<keyid prefix>.link-unfinished'.
    stop        expects preliminary link file '.<name>.<keyid prefix>.link-unfinished' in the CWD,
                signed by the passed functionary's key. If found, it records and adds the paths
                and hashes of the passed products to the link metadata file, updates the signature
                and renames the file to '<name>.<keyid prefix>.link'.

Options:
  -h, --help    show this help message and exit
  --version     show program's version number and exit

EXAMPLE USAGE

Create link metadata file in two commands, signing it with the private key
loaded from 'key_file', recording all files in the CWD as materials (on
start), and as products (on stop).

  in-toto-record start -n edit-files --signing-key path/to/key_file -m .
  in-toto-record stop -n edit-files --signing-key path/to/key_file -p .

Create link metadata file signed with the default GPG key from the default
GPG home directory and record a file named 'foo' as material and product.

  in-toto-record start -n edit-foo --gpg -m path/to/foo
  in-toto-record stop -n edit-foo --gpg -p path/to/foo

Create link metadata file signed with the private key loaded from 'key_file',
record all files in the CWD as material and product, and dump finished link
file to the target directory (on stop).

  in-toto-record start -n edit-files --signing-key path/to/key_file -m .
  in-toto-record stop -d path/to/target/dir -n edit-files --signing-key path/to/key_file -p .